Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[solved] syslog-ng madness #2 : timestampts are wrong
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Kernel & Hardware
View previous topic :: View next topic  
Author Message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3723
Location: Hamburg

PostPosted: Mon Mar 16, 2015 2:16 pm    Post subject: [solved] syslog-ng madness #2 : timestampts are wrong Reply with quote

Upgrade to 3.6.2 at a hardened now gives this :
Code:
Mar 16 15:07:28 t44 dnsmasq-dhcp[7032]: DHCPACK(br0) 192.168.1.143 72:ef:3d:9f:c3:5a trinity
Mar 16 01:41:17 t44 kernel: br0: port 1(tap0) entered disabled state
Mar 16 01:41:24 t44 kernel: EXT4-fs (loop0): recovery complete
Mar 16 01:41:24 t44 kernel: EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: (null)
Mar 16 15:10:01 t44 CROND[5149]: (root) CMD ([ ! -x /etc/cron.hourly/0anacron ] && { test -x /usr/sbin/run-crons &&
t
Anybody else already experienced wrong timestamps ?

Last edited by toralf on Wed May 27, 2015 7:04 pm; edited 1 time in total
Back to top
View user's profile Send private message
krinn
Watchman
Watchman


Joined: 02 May 2003
Posts: 7198

PostPosted: Mon Mar 16, 2015 2:24 pm    Post subject: Reply with quote

you have br0 up and down, if some ntp deamon is link to interface you can have timestamp before ntp was run and timestamp after it no?
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3723
Location: Hamburg

PostPosted: Mon Mar 16, 2015 3:43 pm    Post subject: Reply with quote

krinn wrote:
you have br0 up and down, if some ntp deamon is link to interface you can have timestamp before ntp was run and timestamp after it no?
Well, I'm pretty sure, that there was no ntp jump. And I experienced such timestamp jumps month ago w/o having any virtual (UML and/or KVM) machine connectetd to my br0.
Back to top
View user's profile Send private message
krinn
Watchman
Watchman


Joined: 02 May 2003
Posts: 7198

PostPosted: Mon Mar 16, 2015 3:53 pm    Post subject: Reply with quote

Was just an idea, i remember you were having issues with syslog-ng.
Looks like you won't slept with syslog-ng's dev again tonight :)
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3723
Location: Hamburg

PostPosted: Mon Mar 16, 2015 4:17 pm    Post subject: Reply with quote

krinn wrote:
Was just an idea, i remember you were having issues with syslog-ng.
- yeah - a lot of unprintable chars in version 3.4 and 3.6, vanished w/ setting "thread(no)"
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3723
Location: Hamburg

PostPosted: Mon Mar 16, 2015 7:42 pm    Post subject: Reply with quote

BTW another cure examplehttps://bpaste.net/show/284b35a4fd6b
Here ate he diffs are just few seconds - /me wonders if syslog-ng just delays messages ...
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3723
Location: Hamburg

PostPosted: Wed May 27, 2015 7:04 pm    Post subject: Reply with quote

bug fix is in test now : https://forums.gentoo.org/viewtopic-p-7754438.html#7754438
Back to top
View user's profile Send private message
haarp
Guru
Guru


Joined: 31 Oct 2007
Posts: 527

PostPosted: Fri May 29, 2015 10:52 am    Post subject: Reply with quote

Having the same problem. syslog-ng 3.6.3 fixes it you say? That doesn't seem to be in portage yet.

My temporary fix is this:
Code:
source src {
        unix-dgram("/dev/log");
        file("/proc/kmsg" program-override("kernel") flags(kernel) keep_timestamp(no));
        internal();
};
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3723
Location: Hamburg

PostPosted: Fri May 29, 2015 11:04 am    Post subject: Reply with quote

haarp wrote:
Having the same problem. syslog-ng 3.6.3 fixes it you say? That doesn't seem to be in portage yet.

My temporary fix is this:
Code:
source src {
        unix-dgram("/dev/log");
        file("/proc/kmsg" program-override("kernel") flags(kernel) keep_timestamp(no));
        internal();
};
wget https://github.com/ihrwein/syslog-ng/commit/75dc0c6d4fffeac7a7b0461a6cdc6edd7a62c22c.patch and applied to 3.6.2 works fine
Back to top
View user's profile Send private message
haarp
Guru
Guru


Joined: 31 Oct 2007
Posts: 527

PostPosted: Fri May 29, 2015 2:00 pm    Post subject: Reply with quote

toralf wrote:
haarp wrote:
Having the same problem. syslog-ng 3.6.3 fixes it you say? That doesn't seem to be in portage yet.

My temporary fix is this:
Code:
source src {
        unix-dgram("/dev/log");
        file("/proc/kmsg" program-override("kernel") flags(kernel) keep_timestamp(no));
        internal();
};
wget https://github.com/ihrwein/syslog-ng/commit/75dc0c6d4fffeac7a7b0461a6cdc6edd7a62c22c.patch and applied to 3.6.2 works fine

Threw that in /etc/portage/patches. Thanks!
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Kernel & Hardware All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum